Phish email pretending to be a voicemail with attached .HTM file with encoded link.
Adds “Message Is From Authorized Access.” in a colored box at the top of the email which appears under the Microsoft or Google phish warnings to try to make it seem legitimate.
Received: angela@themaintco.com
Received: tony 138.91.126.15 via mrelayeu.kundenserver.de 213.165.67.99 and mout.kundenserver.de 212.227.126.130
Subject: NEW VM enclose 7 June, 2020
Attachment name: 📞AudioMessage 7 June, 2020_00190_673_66wav.htm
Body:
Hi <prefix of user email>,
You have a message from caller
Caller Number:: +1 512-403-2737
Device Name: <organisation domain> VMCentre-FX-2EFF73
Device Location: Frontdesk
This email was sent to <users email address>
